CVE-2026-104761 kitae-park CVE debrief

Who should care

Defenders responsible for WordPress installations using the Mang Board plugin, especially those with custom-level access users, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-104761 is a stored cross-site scripting vulnerability in the Mang Board plugin for WordPress. Defenders should prioritize verifying exposure, especially for custom-level access users, and assess potential script injection and execution risks.

• Potential injection of arbitrary web scripts
• Execution of scripts when users access injected pages
• Elevation of privileges for authenticated attackers
• Possible compromise of user sessions

Technical summary

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using Mang Board plugin version 2.4.3 or earlier and assess user access controls.

Recommended defensive actions

• Verify WordPress installations for Mang Board plugin version 2.4.3 or earlier
• Assess user access controls for custom-level access and above
• Inject arbitrary web script checks for the 'content' parameter
• Escaping and input sanitization validation for the plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Supplemental sources include Wordfence and WordPress plugin repository references. The vulnerability has been confirmed in Mang Board plugin versions up to and including 2.4.3. Defenders should verify the exposure of their WordPress installations and assess potential script injection and execution risks. Evidence limits suggest that additional details may be available through further investigation and review of the plugin's codebase and user access controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.